exploiting-linux-capabilities

Run getcap -r / 2>/dev/null to list all file capabilities system-wide, and use capsh --print or cat /proc/$$/status to inspect the current process capability sets. Grep the output for high-value capabilities like setuid, dac_override, sys_admin, and sys_ptrace.

If getcap shows a Python binary with cap_setuid+ep, run python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' to set the UID to 0 and spawn a root shell. The same technique works with perl, ruby, and node interpreters.

Yes, cap_sys_admin inside a container allows mounting the host block device. Identify the host disk with fdisk -l, mount it to a directory, then chroot into it or write an SSH key to the host's /root/.ssh/authorized_keys.

cap_dac_read_search bypasses file read permission checks, allowing reads of files like /etc/shadow or root SSH keys. cap_dac_override additionally bypasses write checks, enabling modification of arbitrary files such as /etc/passwd or sudoers.

Per the capabilities man page, a non-root binary showing =ep in getcap output with no SUID bit can still execute with root privileges due to how the kernel treats empty capability sets. Confirm by running the binary and checking that id returns uid=0.

Test capabilities during authorized local privilege escalation after obtaining a user shell, especially when SUID enumeration comes up empty. It is also essential when assessing a container's effective capability set for escape potential.